emotet | 45cdea2b80b133677da888bf2db4c5012e5d561135f4d51e5fdf27c2f3a20215

Analysis

Target
1f936708474a93b189e300f034aab593.dll
Size 496KB
Sample220611-back3sdff8
SHA256 45cdea2b80b133677da888bf2db4c5012e5d561135f4d51e5fdf27c2f3a20215
MD5 1f936708474a93b189e300f034aab593
SHA1 b2be0933ba038b83155087111b025e7a83de4bbc
SHA512 0d8ea9e415d90c20457745cad5f0b6dbf4f6944795b10e51e6c2b155e38a68856c9f86839167dfdf773b8d886015ae14d8d3652dbed577179c4438f4e5bf3a15
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
960	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 996	960	regsvr32.exe	27
PID 960 wrote to memory of 996	960	regsvr32.exe	27
PID 960 wrote to memory of 996	960	regsvr32.exe	27
PID 960 wrote to memory of 996	960	regsvr32.exe	27
PID 960 wrote to memory of 996	960	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f936708474a93b189e300f034aab593.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NKeCcU\cGxXmvWMjMeq.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996

memory/960-54-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Download

memory/960-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download